CrashOverride

CrashOverride is a malware that gained notoriety because it was used to take down the power grid in Ukraine. The CrashOverride attack that happened in December managed to take down Kiev's power capacity down to 20%. PC security researchers have received reports that this attack may have been a test for larger scale attacks. As of today, the CrashOverride malware is the most sophisticated form of malware designed to sabotage power grids that has been observed.

A Secretive Malware that can Cause a Huge Damage

CrashOverride was built to target physical systems deliberately and is only the second of its kind, the first being Stuxnet, which gained notoriety in its attacks against Iranian nuclear facilities in 2009. CrashOverride is designed to be able to adapt to different electric facilities and, if applied in the right way, could cause much more damage and outages than was observed in Kiev in December. The potential of CrashOverride as a tool for carrying out large-scale attacks is huge and still unexplored. Regretfully there is nothing unique about Ukraine as a target for these attacks. There is nothing that could prevent the cybercrooks or hostile states from using CrashOverride to target other countries in these attacks.

How the CrashOverride Attack Works

The CrashOverride attack is particularly harmful because it is automated. In previous examples of these attacks, the cybercrooks will gain attention to the target's system and then switch off power on electrical substations manually. However, in the case of CrashOverride, the program interacts with the equipment on the electrical grid directly, using the protocols used by these machines to send commands and shut down equipment quickly. This means that CrashOverride can be used to perform attacks faster, requires fewer people to carry out the attack, and can be performed with less preparation. The CrashOverride attack, in its current form, shows that this attack can be scaled quite effectively, being used to take down more targets. Earlier attacks would require more than 20 people just to target 2 or 3 different electrical facilities. In this form, CrashOverride can enable 20 people to target up to 15 different sites at once, or more if there is enough time to carry out the attack. CrashOverride can be programmed and automated, which means that it can be used to maximize the effects of the attack. One additional aspect of CrashOverride that is especially worrying for PC security researchers is that this malware can be customized to run without feedback, meaning that CrashOverride can run without being connected to the Internet or receiving inputs from its controllers. CrashOverride can deliver one of four different payloads in its attacks, which can be adapted depending on the protocols being used in the targeted power grid.

CrashOverride’s Potential to Cause Physical Damage

One worrying aspect of CrashOverride is that if it is deployed in the right way, it can be used to cause physical damage to the targeted equipment. For example, CrashOverride can be used to exploit a vulnerability in certain relays that can prevent circuit breakers from operating correctly, causing meltdowns, short circuits, and other possible physical damage, which may even result in fires and other harmful consequences. These attacks can be customized to cause cascades, where one attack can result in additional effects occurring throughout a power grid.

The Possibilities of a CrashOverride Attack

The timing of CrashOverride attacks coincided with Russia's invasion of Crimea and had been linked to state-sponsored groups, much like the Stuxnet attacks on Iran were clearly sponsored by the United States government. One worrying aspect of CrashOverride is that malware researchers suspect that the CrashOverride malware can be adapted to target other high-profile targets and utilities, such as gas, water and computer networks.